# Use PHP5 as default
# Changed PHP handler from application/x-httpd-php5 to application/x-httpd-php5 on Wed Nov 11 19:02:19 MST 2015.
AddHandler application/x-httpd-php5 .php

Options -Indexes

## RewriteEngine enabled
RewriteEngine On


## Disallow access to htaccess.txt, configuration.php, configuration.php-dist and php.ini
RewriteRule ^(htaccess\.txt|configuration\.php(-dist)?|php\.ini)$ - [F]

RewriteCond %{QUERY_STRING} \.\.\/\.\.\/ [NC,OR] 
RewriteCond %{QUERY_STRING} \.\.%2f\.\.%2f [NC,OR]
RewriteCond %{QUERY_STRING} \/etc\/passwd [NC,OR] 
RewriteCond %{QUERY_STRING} \.txt?? [NC,OR]
RewriteCond %{QUERY_STRING} echo%20 [NC,OR]
RewriteCond %{QUERY_STRING} proc\/self\/environ [OR]
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
RewriteCond %{QUERY_STRING} base64_decode.*\(.*\) [OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR] 
#RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>||"|;|\?|\*|=$).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(&#x22;|&#x27;|&#x3C;|&#x3E;|&#x5C;|&#x7B;|&#x7C;).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%24&x).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%0|%A|%B|%C|%D|%E|%F|127\.0).* [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteCond %{QUERY_STRING} ^(.*)cPath=http://(.*)$ [NC,OR] 
RewriteCond %{QUERY_STRING} ^(.*)/self/(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>).* [NC,OR] 
RewriteRule ^(.*)$ index.php [R=404,L]

## File injection protection
#RewriteCond %{REQUEST_METHOD} GET
#RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]\=http:\/\/(.*)
#RewriteRule ^(.*)$ - [R=404,L]


## SQLi first line of defense
## May cause problems on legitimate requests
RewriteCond %{QUERY_STRING} concat.*\( [NC,OR]
RewriteCond %{QUERY_STRING} union.*select.*\( [NC,OR]
RewriteCond %{QUERY_STRING} union.*all.*select.* [NC]
RewriteCond %{QUERY_STRING} ^.*(globals|encode|localhost|loopback).* [NC,OR] 
RewriteCond %{QUERY_STRING} ^.*(execute|exec|sp_executesql|request|select|insert|union|declare|drop|delete|create|alter|update|order|char|set|cast|convert|meta|script|truncate|outfile|dumpfile).* [NC] 
RewriteRule ^(.*)$ - [R=404,L]

<FilesMatch "^(wp-config\.php|install\.php|\.htaccess|php\.ini|php5\.ini|readme\.html)">
 Deny from all
</FilesMatch>

# Stream Video Player - Adding FLV Videos is Blocked By BPS
RewriteCond %{REQUEST_URI} ^/wp-content/plugins/stream-video-player/ [NC]
RewriteRule . - [S=30]

#RewriteCond %{REQUEST_METHOD} POST
#RewriteCond %{REQUEST_URI} .wp-comments-post\.php*
#RewriteCond %{HTTP_REFERER} !.yourwebsite.com.* [OR]
#RewriteCond %{HTTP_USER_AGENT} ^$
#RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L]


# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress


